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m m*t APPARATUS AND METHOD FOB 0)NTKOLUNG DELIVERY OF UNSOLfcT.'K» H i:t:TRONlC MAIL 
(5?) AbsfcracS 
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5 * TVS. DM IK ^ > T lO 
DELIVERY OF UNSOLICITED ELECTRONIC MAIL 

FIELD OF THE INVENTION 

5 The present invention relates to a method and system for coatrollmg the delivery 

of unsolicited electronic ma;! messages over an electronic ccros sic t m network such 
as the Internet. 

BACKGROUND OF THE INVENTION 

The rapid increase so the number of users of electronic ms&l and the low cost of 
tribut g electrode lessages, for example, via the Internet and athef semm-anicaioiis 
networks has made mass marketing via electronic mad 1 an uuromte 

:>dv>-rm.rmg medium. Consequently, e-mail is now frequently used as the medium for 
widespread marketing broadcasts of unsolicited messages to e-mail addresses, commonly 
known as "spam." 

15 ? lec ■ 5 also called "spammers") nse a varied of tec % i 

for -;-„t_ e-mail address lists. For example, marketers obtain e-mail addresses from 
postings on vanoos Internet sites such as news group sites, chat room sites, or directory 
services sites, message board sites, mailing lists* and by identifying "mailto" address 
links provided on web pages. Using these and other similar methods, electronic mass 

20 tarse^rsr , Lvovee • -tar large numbers of smu -- \ v e"- h:emv 

targets for their adverdsements and other misobciied messages. 

i s ■i'F&rrie; .emces and electronic mail, however, are not. eager to have their 
e-mail boxes filled with unsolicited e-mails. This is an increasing problem for Internet 
service providers (ISPs) such as America Online (AOL®) or Microsoft Network 
25 »V v v ( oi -pe 

corpora ons (;e,g., IBh g®, etc SPs object to junk nail 

because it reduces their users' satisfaction of their services. Corporations want to 
eliminate nan. mail because it reduces worker productivit) 

L.OTdrgi \^ s v r e^ ^ us s 

30 0 t x ^ ^ S 1 v v !'! s < 

users, foi exnmo.e H re\fr* , £ , v users' to- boxes. 
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! - >" ! nges u t 

d>tmet ve c - <v mode, or i-.therv.ise > u ' r Urn delivery- of such messages to the - 
users. 

SUMMARY OF THE INVENTION 

■5 Accordingly, it is the- abject of the present invention to provide a system and 

" i « clii gt eds v solicited electronic i essages im") ovt 
an electronic cewnumeations network such as the internet by identifying the source of 
taemifba « span p~otr ^ ' t „ e s. <• 

servers and/or user terminals to sources of spam in order to activate an effective filter or 

1 0 "spam wail" program, mxmmxk servers or t sser tend nal s or both. 

According to rise method sad system of the present invention, one or more Spain 
pn she e-mail add; esses are cteated and psanted at \ arious sm> o s 

network in order to insure their inclusion on large-scale electronic junk mail ("spam") 
mailing lists. The mailboxes corresponding to the spam probe e-mail addresses ajfe 

15 monitored for incoming mail by a spars confcoi center. Upon receipt of incoming mail 
addressed to the spam probe addresses, the spam control center automatically analyses 
the receix en mail to identify the source of the message, extracts and proce ;ses the source 
data from the received message, and generates an alert signal co . . - e processed 
sowm data. The alert signal may also contain filtering instructions used to enable 

20 network servers and user terminals to automatically detect spam. This alert signal is 

>roadc; j all network servers: or all user terminal r be within the con w tions 
network. A filtering system implemented at the servers or user terminals automatically 
receives the alert signal, automatically updates stored filtering data using the source data 
retrieved torn the alert signal, and automatically controls delivery of subsequently- 

25 received e-mail messages from the identified spam source. Any filtering instructions are 
also stored and used to process incoming e-mail messages. The filtering s> stem controls 
aenverv of tin; unsolicited e-mail messages by discarding * messages without 

1 e ^ess b t > euse \ tl 
marker, or by otherwise processing the spurn mail as desired fay the network provider or 

30 the network users, lite filtering system may also be used to filter e-mail messages sent 
from the user terminals. 

2 
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A system tor controlling delivery of unsolicited electronic mail according to the 
present invention includes a coasmunicaiions network including at least one user terminal 
and a control center. Trie control center includes a distributor for distributing a probe 
address to multiple sites on the communications network likely to be accessed by mailers 
insoi electronic a , ec > ot rece 
: v th eaddi s and extracting - nee data from the reeeh cd electrt me 
mail messages, and an inert < n generator coupled to the processor for generating and 
transmitting^ alert signal incorporating the extracted source data and, optionally, 
filtering insm^Uom. The system according to the present invention may further include 
at least one network server coupled to the communications network and a plurality of 
user terminals coupled to the network server, A filtering application may be 
implemented in each of fee network servers, each of the user terminals, or both. The 
! 01 <. i r d <.c pt 

the alert signal osmg the source data and fjitering msuuouons retrieved from the alert 
signal, and filters electronic mali messages addressed to each of the user terminals in 
accordance with updated filteriisgdaia. The filtering system may also be used to fiier 
- u ^ t s g e c erminals 

A method of identifying sources of unsolicited electrode mail according to the 
present invention includes the steps of: 

(a) ere. en c a prof e adores ; dis bating the probe address to multiple sites on a 

<. j. 3 v rk Ysccly to oe oceev\ t u , j ( 

mail; 

(b) monitoring she cotsmunieations network for e ectroaie mai i addr « sen to the 
probe address; 

(c) upon receipt of an electronic mail message addressed to the probe address, 
extract-log arid processing source data from the received electronic mad message; 
and 

(d) generating an alert signal incorporating the processed source data, 

Amsthoc or com; tronie m rdingtothe 

present invention includes the steps of: 

3 
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(a) itmgap ) < , - uxm he probe a ires :> multipfc son; 
nnuuiicaticns netwoi kely to be acc dl ik smoiu _ nk 

mail; 

(b) , s po i ^.ee.p 1 el .1 s-ec a < fi.a mom 

extracting < 1 message; 

(c) n " * an alert signal incorporating the processed source data and, 
optionally, filtering instmc&ns; 

(d) receiving fee aim signal at a filtering application for filtering electronic mail 
ire^asyes* updating filtering dssa stored H r v. ' ?g appik ^ sing the 

3 * OV L < , <■ r v 

(e) 1 ' ! 2l t Ui )>s L* s " - V ^ IX ^ 

acoKumm v ■ - mdata. 

The foregoing and other features, aspects, and advantages of the present invention 
will become more apparent from the following detailed description when read in 
conjunction with the accompanying dmwirig& 

BRIEF DESCRIPTION OF THE DRA1MGS 

FIG i provides ock gia of a system for contrail a delivers 
unsolicited electronic maii according to the present invention. 

I ,G 2 provides r ^ ock d agram of user *en I c?oor V 

use in trie system of FIG. I . 

FIG. 3 provides an example of data stored in ar; exclusion list used by the Altering 
ff'IG.2 

FIG. 4 provGes a block diagram of an aheroarive embodiment of a user terminal- 
based nhenog application tor use in the system of FIG, 1 . 

HG * provde&i block diagram i * k - t\ ! „ , - 

ass in the system of FIG. I 

FIG. 6 .provides a block diagram of an alternative embodiment of a network 
server-base d - p!i cation tor use in the system ,4' FIG. i 

FIG, 7 provides a process Sowchai as edifying >mees ■>* 

unsolicited e-mail messages accordion to the present invention. 

4 
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FIG. 8 provides a process flow chart fox a method for controlling delivery of 
dl messages aceord ie pre 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
The present invention will now be described with reference to the accompanying 
5 drawings, which are provided as illustrative examples of preferred embodiments of the 
present invention. Notably, the present invention may be implemented using software, 
d % r- ><■ o 1 u ^ - a i , i 1 

FIG. 1 depicts a preferred embodiment of a system 100 for oomroUleg the 
diver ms * ironic ma messages Wit eference to Q jsysteo 1 
1 0 for controlling delivery of unsolicited electronic mail messages, e.g., spam, according to 
the present invention includes a control center 101 coupled to a communications network 
1 1 0, for example, the internet or other wide area network Aj > <. 

servers 120, 121, and 122 are coupled to the control center 101 and the communications 
* ..-id 18 arc ^spe v 0 v. I =■"> e i 
15 shown in FIG. 1. 

The control center 101 includes a processor 102 for creating spam piobe 
addresses, a distributor 103 connied to processor 1 02 for distributing the spare probe e- 
mall addresses to \ r y ntes wil of :ado rtetwi * Uniprocessor 104 

p t j k'iU iisuibntor . ^ s g n a 

20 addressed to the spam probe address and extracting and processing source data from the 
received e-mail messages addressed to the spam probe address; and an alert signal 
generator 1 05 coupled to processor 104 for generating alert signals to the servers 1 20422 
or user terminals 1 304 38, or both. The alert signals incorporate the source data from the 
3 icssages add esss a e s 1 add j s r , c - cesser 1 04 and 

25 may also incorporate filtering instructions entered, for example, via control terminal 3 06. 
Control terminal 106 is coupled to the control canter 101 to control and monitor operation 
of the control center 101. Additional control terminals (not shown) may optionally be 
provide v components of the control center ' 0 1 need not he <: ens hidat - ime 
location and may be implemented as a distributed system of processors, components of a 

30 j , . * / ) stem, or other 1 - - -i— crt u one of skill 

in the an . 
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detau The system iOi t ee-xonie ma messages 

created by processor 102 to identify sources of unsolicited e-mail or span:;. A spans probe 
5 % s as e evtes to make it? «a> orn< &s many ^:rv\ mailing 

tsaspos e t £ | jess alsoseie r p on the spammers 

lists in order to receive mailings relatively earl> in the spammers' mailing process. For 
example, fee spam probe address may be selected to apueat a? the top of an alphabetized 
mailing list (e.g., "Aardvark @aol.eom"). In a preferred embodiment of the system 
10 according, to the present invention, a certain percentage of assignable e-mail addresses 
offered by an ISP or private network are reserved for use as spam probes. 

Once a spam probe is created using processor 102, distributor 103 distributes the 
spam probe, to a number of sites on the ceimniKucatioas network I i 0 likely to be browsed 
by spammers. For example, on the Internet, sites likely to be browsed by spammers may 
! 5 include chat room sites, directory services sites, mailing lists, message board sites, and 
news grc ; u as well i J* \ ress ks provic on ?d • ) pages, in 
this way, the sparn probe address preferably would be distributed to various locations 
fee network and posted with the intention that spammers * Li fin, tht addre.s lU d add i . 
their mailing list as they browse the network 

W- After the spam probe has been distributed on the network 1 1 0, processor 1 04 

Vrc^n > e „.J rc s cw rd " * 1 s > t 3 j v - i ' •»( rl 

1 10 for e -man messages addressed to the spam probe address k c « > prefcrres 
embodime t armor the mailbox cor spo an probe 

ted witliin processor 1 04 m this e v nent ; 
25 addressed to the spam probe address are automatically forwarded to processor i 04 by the 
network HO. 

I'u addition to receiving incoming e-mai messages automatical!} I rwarded b> the 
network - u retrieve 

e-mail messages frum probe sdt s ' v tsothe 

30 -vpaT nnoex t\ efsuen methods helps to tr* r>-hne>vS of receipt of 

spatn and immunity to denial >f ses ;e attack sxample, where a stumer sends 
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nurnemui; processing commands to the spam probe server in erder to keen the server 
busy, thereby preventing the server from receiving incoming c mad messages). 

Once t >c informs? on o> 
received by processor 104, process - ocessing 

5 methcx tnewn in the an and extracts the sot rce 1 cade; dat U m t >e reoen ed e mai 
red ems - n r a mi 

additional analysis of the received e-mail messages using control terminal 1 06. Processor 
104 then outputs the extracted sosrrce data to alert signal generator 105. 

"f he processing performed by processor 104 may include analysis of the source 
10 tea a .c re-.u -->; v ?gg cr etem . . - 

internet Protocol (IP ) address of the sender or the address of the servers } relaying the e- 

' v. < " ! <- v 1( „ .NEH! ( - * f H ^ .g -V >0 } Ov N. . 

c i - i may also extract and analyze < i other Ids of the 

recei ved e-mail message, including other header fields such as the SUBJECT or 
: 5 MESSAGE ID fields, and the body of the e-mail message. Processor 1 04 pmvides the 
: t signal generator 1 05, 

Upon receipt, bed; * t. from processor 104, aiert signal generator 10$ 
H-eierabh enerate source data * 

eccoe< e-mail message as well as other data analysed by processo; ' ; i , 
20 i is ! v i . . , h mmvd 0> 

the user terminals or network servers. Filtering instructions may be provided to the aiert 
; ignal gene -ator 1 05 for example, via control terminal 106, Aim. signal generator 105 

c it each sers - 2 e e >pho 

dedicated communication link 140 or via the common:' cations network 1 10. 

25 Filtering instructions may be transmitted from the control center to the servers or 

user terminals or both to update and control the filtering operation performed by the 
servers or user terminals or both. For example, a filtering instruction may instruct the 

v. ".v^rma n:\ < k n- cn 

source in the series of servers listed in the received field, if die domains of the two fields 

30 do not match, the server or user terminal would mark the e-mail message with a code, 
such a-. .fifN'lv, m.:V; is - . , , t r , ructions as 
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would be apparent io one of skill in the an sissy also be provided m order to insure 
effective spans filtering. 

of unsolicited e-mail shown m FIG. I includes 
>r a server-based filtering application, or a 
g io a preferred embodiment of the present invention, 

e or software, or a combination thereof as is known in the art. The altering 

is transmitted by alert signal generator .1 05 



of the e 
10 (wfaefo 



r 101, Upon receipt of the alert signal, the filtering application 



;e ata and nses it date its ering p 
.v v.-iir. . ^ v. :. :' ICS. 2 through 6. 



In the preferred embodi 
m for use in the p 



in FIG. 2, a a 



ifiitenng 



r202 



ril messages. Dam in the exclusion list may be divided into categories 
to the fields of incoming e-mali messages as illustrated in FIG. 3. For 
ing using the "FROM" category of the exclusion Est may be sufficient to 
rs and/or service providers may 



"TO'\ -BCCr "CCT and "SUBJECT" e-mail headers and other headers. Fltering may 
also be based on the contents in the body of the email. The user exclusion list may be 
25 automatically created and maintained and/or create ~ i ? by the user 

or service provider. 'The user terminal may also perform filtering based upon filtering 
rlfil. 

in FIG. 4, 
by 



30 sour rvo, . 
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center 1 01, and transmitted in the alert signals are used t< 
filtering applications in the user terrninais 130-138. 

Thei: 



in the preferred embodiment depicted in 
**e 206, which receives and stores 
? e-mail and stores records of 'outgoing e-mail An e-mail filter 204 filters the 
I e»raaii stored in store 206 in accordance with the user exclusion fist stored in 
202. A user interface 208 is provided to receive inputs from the user and to 
-mail information to the user. Hie user interface 208 may he implemented, for 



. User interface 208 may 
be used to display a user's mailbox, receive and process e-mail messages and inputs from 
the user, manage the user's mailbox, display mailbox management information to enable 
the user to manage thy mailbox, and perform other functions as are known in the art. 

15 Filtering of incoming e-mails may preferably be performed as follows, if the data 

in any of the "FROM" field of the mcomkg e-mail message match data stored m the 
corresponding data category of the exclusion fist manager 202, the e-mail is marked by 
the filter 204 with a first display code indicating the "WMC status of the message. 

20 of "JUNK." If no match is detected between the fields of the received e-mail message 
and the stored exclusion fist, file e-mail is marked with a second display a 
the "OK" status of the message. Notably, the filtering system may be program* 
search not only for precise text in matching data fields, but also for similar text 



The marking of the incoming e-mail may be accomplished using known 
programming techniques, for example, by adding m additional field of 
received e-mail format or by altering one or more existing e-mail fields 
display status of the e-mail. 

In one embodiment of the filtering application for use in the present invention, 

are not displayed in the user's in-box and are automatically discarded by the filter. 
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,e e .'"N'C'Teuus'v be aodlf.ed to indicate so e i that tk 
messages are unsolicited, for example, i no 1 i he word "JUNK" at' 

ihebegimh > ,g ie message ia & 

* s * " r> ' c < he <" ! m 1 older m the 

5 us>er s in-bos or by other si itt bk nean % m the ss x 3rd u spiaj coat? 

indicating the "OK" status of the: message preferabh ire automatical!;; displayed in the 
oscr's inbox by the user interface 108 in a display mode visually distinct from the display 
1 < ty displa jess e Various known < play method maybe 

used to distinguish "OK" mail messages from m N \ mail messages on the user's 
1 0 display screen. 

In another preferred embodiment of the filtering system according to the present 
ivention e-n < , 

pro cp cd by the filter usmg user preiereme ^ % \e -,cr The user m,tv, •or 

£• desire to eceb e unsof ch m nessag > > to ot s or more 

15 sp« cts Accordingly, the user may enter into his or her terminal a list of 

subjects which is stored as preference data by the iitermg application. The filter 
application compares die subject data of the received e-mail message with subject 
preference data entered by the user. Notably, the subject data from the received message 
may include -'SUBJECT" header information, the full text of the e-mail message, or both, 

20 A text search may be performed to determine whether the subject data irorn the received 
e-mail contains any of the subject words or phrases entered by the user as preference 
data. If a match is detected m*.-r „ v. > e < ( >-m < j code and 

displayed to the. user in a third distinctive mode using known display techniques. These 
v o- (.N^-s > l<x e, »e u ■> ^ ~ jti u J ,c Mi^ 

25 be i n-i ing application oi ! N stive c 

luyetano t rre - b Her: 2 nation fs -em die 

present invention, the ftitering application stores predetermined classification data, which 
are used to sort incoming unsolicited e-mail messages into predetermined categories. The 
ttkering application may, for example, search the ''SUBJECT" header data of the 

30 received e ~n < message, other headers, the text of the message, or all three, to determine 
whether tk , ai n an) >v ord s i r phrases 

matching the subject infor 1 e terrosned category. In this 
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erobodhneot, each predetermined subj ect category of messages is associated with a 
specific display code. Aecorditrgly. received messages in each predetermined category " 
would bfc dispisyed to the user in different display modes to visually distinguish the 
eategor es 03 tie ted e-mail 

5 messages m one or more of the predetermined categories, or none of the categories. 

e he preseat invention may - * a * Ik 

user enrtmai either as an ime i a u e - . a h t as 

Netscape Mcssager, Microsoft Outlook, Microsoft Exchange, Lotus cc: mail, Lotus 
Notes, Novell mail, Etsdora, or AOL, or as - mtert -W *«h the 

10 r ^ mAea erme; emoomm b - 4 e c 

o h i tits son ii v. ;rc 2 A io access, modify, and categorize e-s jaii message a descri ;d 
h v T v. tc ^ temrna; s< >e i et ter ; going -ma - gessen 
the user terminals. 

FIG. 4 illustrates an alternative embodiment in which the filtering application is 
15 imp km c -t v • w aim c, w one me: >\ wmM A klxw e : 5 LIA. I I e t mat. uker 
204 recei ves and filters mcommg e-mail messages before they are stored is e-mail store 
206, and ma cs;t g - ; y the ?rminais Fhi embodiment 

•nay be implemented using a known message communications means, such as 
Microsoft's Mass API (MAPI) or an Internet mail protocol such as Post Office Protocol 
20 (POP3), IMAP or Simple Mail Transfer Protocol (SMTP). In a preferred embodiment 
ising user ten e system Tccorth o i may fee 

implemented as an add-on system to a known e-mail software package using MAPI . 
configured as a network service provider. This embodiment has the advantage of 
s v ft) M ft 1 1 eotation of the pee >en m e rtion < me j ;er u rmmai 

25 i s embodiment in which the 

invention is Implemented within network servers. This embodiment enables filtering to 
be performed at a relatively small number of locations for all users within a network. A 
server, e.g 20 shows n PKL ft. roeeives rm i < i from 

uluu st> r s\ iFlQ. I v em es m e-mail 

30 server message store 506 tor receiving aim storing ad e-mail messages transmitted within 
the netw >rk lit. and ao s x i o~cs and 

maintains at least one exclusion list for each e-mail address that is serviced by the e-mail 



SUBSTITUTE SHEST (RULE 26) 



WO 99/33 SSS 



server 12C xnc 1 n s net sion list 

- li s a separate use ssioi for each u 

user terminals 130-133 shown in FIG I . The server 120 may al c filter outbound 
messages se - be users using a eratic 

5 idiiional £ >s3a f the present Invent a leu 

within the above-described preferred embodiment or separately ttrpie.-reioee in a 
different embodiment of the present invention is a functionality by which multiple 
exclusion lists are maintained. One or more selected exclusion lists are applied in 
filtering for all user terminals 130-133. One or more selected exclusion lists are applied 
10 in filtering fbt only certain user terminals:, e.g., only user terminal 130, Accordingly, this 
iodcoc j es w l t ers selective filtering of certain us t-mtinah 
and general filtering of ail user tenmnahn 

The operation of the components of the server 120 shown in FIG. 5 is similar to 
the corresponding components in the user-site system of FIG. 2. Ail e-mail received by 
1 5 server 1 20 is stored i n e-mail store 506* The e-mail filter 504 filters the stored e-mail 
messages in accordance with the information stored in the exclusion list processor 502. 
> ,fw Jh^ vnm.lG I is 

using the exclusion list stored for each user respectively. Once the e-mail stored in store 
i is | ^ 11 >A by e er 504. the fdterer e-mai is th* forwarde o 1 users 

20 respective 'user sites. 

,css performed fo- e 

sdb) her' 4 is G.2 he filter 504 enmpares 
the data stored in the "FROM" header Held (and optionally the 'TOO "COO " BtX 0 and 
''SUBJECT" fields smd associated sub-headers OefdO of the incoming e-roail messages 
25 w n corresponding categories of data stored In die o i ! ptoeessoi 502. in* m 
)y of these of the ncor gc-m matches data stored in a corresponding field of 
the inclusion list processor 502, Use incoming e-mail is marked "JUNK" and marked with 
»Srs« display code if no match is detected, the e-rr I filter adds the e-maii message as 
Nk n c"r> i e,s -pt . 

30 display the id \"U nu^go* O ^ib ee\ or s- op iCLv | nes as described above vith 
t oe o K S may i so ~e ! cade 
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In the preferred server-side embodiment shown in FIG. 5. the ©-mail filter S04 
interacts with fee e-mail message store 506 that processes the e-mail and performs other 
known functions for a multiplicity of e-mail addresses or accounts, in this embodiment, 
the e-mail store 506 n e addition - \ xwa the cs ;gors c i each e-mail 

5 message 1b an alt< ive pref< - diment, the stat f e-mail ness ages 55 
ia a scaiaate v aiaoa, s , r sr m 50U, 

The exclusion list processor 502 may m an c ■: hosmn hs; tec each e mail 
address or . akekfcatively, an exclusion list -for each group of e-mail addresses organized 
by domain or other group. According- to another preferred embodiment each exclusion 
10 list created and maintained by the exclusion list processor 502 includes an additional data 
fie i d k licr i} efcx-aeterisficsof at least one user account or e-maii address. This 
embodiment has the advantage of providing centralized -mao&gement of accost 
inform, alien. 

FIG. ( m alternative preferred embodiment a wi . t v 0 1 

IS' receives and niters incoming e-mail massages before -t . < ne-m. store 506 
This embodiment may be implemented using a known message communications means, 
such as MAPI or an Interna Mail protocol saeh ssFQPS, IMAP or SMTP. This 
embodiment ha* theadvastag c ilcations link 

by filtering nut junk e-maii before it is stored at the server. 

20 \. " * .< \ , 1 < e t 

advantage of enabling quick deployment of the invention because server software can 
generally be undated more quickly than user terminal software. Filtering rales may be 
updated in real-time or near real-time on the server, allowing rapid response to new 
nstanees ot ink mail. This embodims s the a 

25 mpl * s enviromo ere the; ; he e-mail user i\- 

sending mm e-ma i users who will not read .them. 

Additional control of the filtering applications implemented at the user terminals 
or servers, or both, may optionally be provided via die control terminal 106 shown in 
30 FIG c ( e of servers 120-122 

1 est: m t 5 aispasysie a or subject data, or 

both, to be added to die filtering application exclusion lists. Accordingly, a service 
13 
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provider may prevent users from receiving e-mails from specific sources or e-mail 
messages ,u ' sriain subject t - ponies rbje by addmg 

source data and/or subject data to the filtering application exclusion lists The network 
use or may not beg i _ V exc as « t 1 a<r< 

5 entered by the system operator. Service provider eatrisss la The exclusion bat may or may 
not be displayed to the users. 

Users iyrnanu; , similar limitations for their a mesl 

manually entering data into the exclusion list 

Wiih reference to FIG. 7. a method for identifying sources of unsolicited 
10 electronic mail according to the present invention includes the following steps; 
701 - creating a Spain probe address; 

702 - distributing the Spain probe address to multiple sites on a cormmtmications 
network likely t be accessed by m; ers oi so isc >nie n 

703 - upon receipt of an e.ecTemc mad me" - . ■ W1 ?-)\- 
1 3 address, extracting source data from the received electronic mail message; and 

704 - gene, g an alerts - » .me data 

Wim reference to FIG. 8, a method of controlling delivery of unsolicited 
electronic mail messages accorc s . the press rc I jwiag steps 

■ - o<» j g a --nam probe address; 

20 802 - distributing the spam probe address to multiple sites on a communications 

network Likely to be accessed by mailers of unsolicited electronic mail; 

80;'; - upon receipt ofaa electronic mail message addressed to the spam probe 
address, extracting source data from the received electronic mail message; 

804 - transmitting an alert signal Incorporating the extracted source data; 

25 805 - receiving the alert signal at a filtering application for filtering electronic 

mail messages; 

806 - -updating filtering data stored by the filtering application using the source 
data retrieved from the alert signal; and 

14 
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807 - filtering the electronic iaaU messages received by the filtering application ia 
accordance vffii the updated filtering data. 

Hie filtering method according to the present invention may also be implemented 
in combination with one or more inclusion-based filtering methods as would be apparent 
to one of skill in the art. 

While the present invention has been particularly described with reference to the 
preferred embodiments, it should be readily apparent to those of ordinary skill in the art 
that change? and todi \ ens in form and details may be made without departing from 
the spirit and scope of the invention. It is intended that tits appended claims include such 
changes and modifications. 



15 
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CLAIMS 




a server coupled to s 



a plurality of user terminals coupled to said server. 



red filtering data upon receipt of said alert signal and filtering 

accordance with said updated filtering data. 
4. A 



6. A .method of 
of: 



s on a wmmunications n 



upon receipt of an ei 



genefating an alert signal incorporating said extracted source data. 
?. A method for 
steps of : 



distributing said probe address to m 
upon receipt of an electronic mail n 



receiving said alert signal at a £ 



for filtering electronic snail 



I? 

substitute sheet (miB m 



pcr/usesoaMi 



filtering said electronic mail messages received by said Shering aspiicauon is* 
accordance with said updated fiileriag data. 
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CREATE A SPAM PHOBl ADDRESS 



701 



DISTRIBUTE THE SPAM PROSE ADDRESS TO 
MULTIPLE SITES ON A COHHUNfCATIONS NETWORK 
LIKELY TO BE ACCESSED BY MAILERS OF 
UNSOLICITED ELECTRONIC MAIL 



UPON RECEIPT OF AN ELECTRONIC MAIL MESSAGE 
ADDRESSED TO THE SPAM PROBE ADDRESS, EXTRACT 
SOURCE DATA FROM THE RECEIVED ELECTRONIC MAI MESSAGE 



GENERATE AN ALERT SIGNAL INCORPORATING 
THE EXTRACTED SOURCE DATA 



FIG J 
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CREATE A SPAM PROBE ADDRESS K^ 801 



DISTRIBUTE THE SPAM PROBE ADDRESS TO MULTIPLE SUES 
ON A COMMUNC*TK)NS NOWORK LIKELY TO EE ACCESSED 
BY MAILERS OF UNSOLICITED ELECTRONIC MAIL 



.802 



UPON RECEIPT OF AN ELECTRONIC MAIL MESSAGE ADDRESSED 
TO THE SPAU PROBE ADDRESS, EXTRACT SOURCE DATA FROM 
THE RECEDED ELECTRONIC MAIL MESSAGE 



,S03 



TRANSMfT AN ALERT SIGNAL INCORPORATING 
THE EXTRACTED SOURCE DATA 



RECEIVE THE ALERT SIGNAL AT A FILTERING APPLICATION 
FOR FILTERING ELECTRONIC HAIL MESSAGES 



805 



UPDATE FILTERING DATA STORED BY THE FILTERING APPLICATION 
USING THE SOURCE DATA RETRIEVED FROM THE ALERT SIGNAL 



80S 



FILTER IKE ELECTRONIC MAIL MESSAGES RECEIVED 8Y THE FILTERING 
WOCAHON IN ACCORDANCE WITH THE UPDATED FILTERING DATA 



807 



FIG.8 
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